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APOLLO EXPERIENCE REPORT 
SYSTEMS AND FLIGHT PROCEDURES DEVELOPMENT 

By Paul C. Kramer 
Lyndon B. Johnson Space Center 

SUMMARY 


The participation of many engineering specialists was required to determine ef- 
fective crew procedures because of the complex nature of the Apollo spacecraft systems 
and missions. Two distinct lines of procedural development were required. The first 
of these, systems procedures, encompassed all of the various systems operating modes 
and was generally independent of the mission plan. The second category, flight pro- 
cedures, produced an optimum crew time line for each mission phase by incorporating 
mission constraints and requirements into appropriate system operating modes. 

Verification of flight crew procedures was often accomplished simultaneously 
with crew training in man-in-the-loop simulators. Procedures in the final flight plans 
were further verified during simulations that involved the NASA Manned Space Flight 
Network and the Mission Control Center as well as the flight crews. Changes in pro- 
cedures could be made during the mission definition phase, during the procedures veri- 
fication phases, or within the final flight plans. 

During the Apollo Program, it was found that a procedures control board was 
necessary to maintain correct crew procedures when changes were made in the mission 
and systems. The operation of this board ensured that every organization concerned 
with mission operations was provided with current and complete information on crew 
operation of the spacecraft, that all proposed procedural changes received a thorough 
review, and that management was provided with sufficient information concerning the 
number and nature of procedural changes. 

During procedures development for the Apollo Program it was learned that the 
crew, given certain basic flight displays, could monitor and assess the performance 
of automated systems during normal operation; accomplish the primary mission ob- 
jectives despite a variety of possible subsystem failures or degraded situations; and 
make real-time decisions during emergencies to abort the primary mission and return 
safely to earth, to accomplish alternate missions, or to continue the primary mission 
using manual backup techniques, thereby enhancing crew safety and mission success. 


INTRODUCTION 


The major contributors to this report and their respective areas of responsibil- 
ity were: Charles C. Thomas, guidance and control systems; John F. Whitely, elec- 
trical power systems; David R. Brooks, communications systems; James L. Baker, 
environmental control systems; William A. Chanis, propulsion systems; Michael R. 
Wash, launch and translunar injection (TLI); Clark M. Neily, rendezvous; Charles O. 
Lewis, lunar descent/ascent; and James O. Rippey, entry. 


Scope 

The development of systems and flight procedures is described in this report, 
and the information gained through the period ending with the Apollo 11 mission is 
summarized. Detailed development, formats of flight plans, and procedures for photo- 
graphic and extravehicular activity are beyond the scope of this report. 


Definition of Systems Procedures 

The operational modes of each spacecraft system were defined by NASA and 
prime contractor personnel during system design, development, and testing. Systems 
procedures were defined as the sequence of crew actions necessary to operate a space- 
craft system. The systems procedures were compiled into a spacecraft operations 
handbook before mission plans were defined in detail. This handbook was a baseline 
or control document for Apollo missions, and it included modifications to systems 
procedures that were based on previous mission experience. Alternate modes of op- 
eration were described from which particular modes could be selected for specific 
mission requirements. Malfunction procedures also were developed, verified, and 
documented. These systems procedures were the building blocks for mission- dependent 
flight procedures and flight plans. 


Definition of Flight Procedures 

Flight procedures were defined as the timed sequence of all crew actions neces- 
sary to accomplish a particular mission task. Flight procedures prepared for time- 
critical or extremely involved crew activities were developed by combining systems 
procedures and specific mission requirements. Several iterations of the basic mission 
task were necessary to establish the detailed steps required of the crewmen and to en- 
sure compatibility with available flight consumables. The flight procedures were 
highly dependent on the mission definition and were constrained by such factors as 
elapsed time, mission rules, and interactions of the different spacecraft systems. 
Separate flight procedures documents were published, and these documents formed the 
basis for the procedures included in the flight plan or in the onboard data for each 
Apollo mission. Appropriate systems procedures were combined for the normal mis- 
sion, profile and for contingency situations. 
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Definition of Flight Plans 

Flight plans integrated the relevant systems procedures and flight procedures 
into an overall time line and schedule for the effective accomplishment of a specific 
manned space mission. Essentially, the flight plan provided the sequences by which 
separate tasks were performed and the schedule by which critical mission maneuvers 
were controlled. 


PROCEDURES DEVELOPMENT TECHNIQUES 


Because of its complexity and scope, the Apollo Program allowed more auton- 
omy for the flight crew than had existed for the crews of previous space flight pro- 
grams. Communications between ground control and the spacecraft would not be 
possible when the vehicles were behind the moon. Rapid flight crew decisions would 
be necessary in some situations in which neither adequate time nor complete informa- 
tion was available for ground-based decisions. As a result, the development of com- 
plete, accurate, and accessible flight crew procedures was vital for mission success. 

The technique used to develop flight crew procedures was basically a progressive 
process. Systems operating procedures were provided by the equipment contractors. 
Flight procedures were developed from the systems procedures when all the goals, 
requirements, and trajectories of a specific mission had been established. Portions 
of the flight plan and the onboard data were developed from the flight procedures. The 
procedures were subjected to verification tests and simulations, were documented, 
and were rigidly controlled with respect to additions or changes. The flight crews 
were trained to follow the established procedures in the use of all systems and in the 
various mission phases. 


Developmental Processes 

Systems procedures . - A comprehensive knowledge of the specifications to which 
the equipment was designed and fabricated, of the limits on equipment applications, and 
of the operating configurations and sequences of the system was necessary to the estab- 
lishment of operating procedures. Details on such activities as activating a system, 
performing the tasks necessary to operate a system in the correct sequence, and in- 
terpreting system- monitoring indicators were included in the operating procedures. 
Procedures for operating each spacecraft system were first written by the manufac- 
turer of that system. 

Systems procedures included normal /backup operational conditions of spacecraft 
systems together with abort, malfunction, and emergency operations. Frequently, 
backup procedures consisted only of activating secondary systems or backup equipment. 
Malfunction procedures, in particular, required detailed knowledge of the structure 
and operation of the system. Systems- failure modes for as many malfunctions as 
possible were grouped under the symptoms they could be expected to cause. Symptoms 
and failures were then grouped to facilitate location and correction of problems. Mal- 
function procedures were subjected to repeated reviews, tests, and simulations. 
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As systems operating procedures were developed for each Apollo spacecraft, 
they were reviewed by systems engineers and subjected to tests and systems-oriented 
simulations. Errors, equipment malfunctions, constraints, and gaps in the proce- 
dures were identified and either corrected or noted. The cycle of review, test, and 
amendment of systems procedures continued through the flight procedures development 
phase. 

Flight procedures . - Flight procedures were, essentially, systems procedures 
• applied to mission-oriented tasks, maneuvers, and trajectories. The development of 
flight procedures can begin only after the requirements, rules, and trajectories for a 
specific mission have been established. The flight procedures were developed on a 
step-by-step basis from the systems procedures and were timed and sequenced appro- 
priately for each activity or phase of the mission. The preparation of flight procedures 
involved the generation of onboard charts, definition of propellant requirements, and 
performance of digital computer checkruns to confirm the feasibility and accuracy. 

The development process demanded attention to a wide spectrum of factors, such as 
mission goals and rules, constraints to the operation of individual systems and to the 
simultaneous operation of interacting multiple systems, time requirements for specific 
tasks, consumables budgets, most efficient maneuvering rates, and crew rest periods. 
Some of these factors imposed constraints on certain activities or conflicted with other 
factors. Such factors were subjected to additional analysis, testing, and reformula- 
tion of flight procedures. 

Because of the variety of systems, crew activities, and mission factors to be 
considered, a broad span of skills was required for flight procedures development. 
Specialized knowledge and contributions were provided by systems engineers, systems 
analysts, mission planners, flight controllers, test and simulation specialists, and 
flight crews. Preliminary flight procedures were reviewed and tested repeatedly in 
man- in- the- loop simulations. 

The activities for specific mission phases were checked out in mission-phase 
simulations and in integrated spacecraft systems simulators to establish flight pro- 
cedure compatibility with the time to be available during the mission, variations in 
the mission (such as dispersed trajectories), and contingency situations resulting 
from degraded system performance or from failed components. Eventually, the Mis- 
sion Control Center or other ground- support systems, such as the Manned Space Flight 
Network, were also included in the simulations. 

As flight procedures became firmly established, they became the basis for flight 
crew training. The training activity, in turn, resulted in significant improvements 
and modifications to the procedures. The schedule for development of systems and 
flight procedures and the organizational relationships involved in the development are 
detailed in table I and in figures 1 and 2. 
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TABLE I.- MILESTONES FOR CREW PROCEDURES AND TRAINING 
[Based on 4-month launch schedules] 
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Figure 2. - Organization chart for 
development of Apollo flight 
plans. 


Verification Processes 

Verification of procedures continued 
throughout the procedures development 
process. During the design, fabrication, 
and testing of the spacecraft components and systems, test and simulation facilities 
were developed to establish systems procedures and operating characteristics. 


Figure 1.- Procedures development 
cycles. 


The contractor suppliers of spacecraft systems developed important test and 
simulation facilities. A high-fidelity, digital simulation facility for flight computer 
programs was built in Cambridge, Massachusetts, to check out various digital routines, 
verify program modifications, and define operations for the use of the onboard Apollo 
computer. Major contractor simulation facilities also included the Mission Evaluator 
at Downey, California, and the Full- Mission Engineering Simulator at Bethpage, New 
York. 


After individual spacecraft systems procedures were verified, simulations that 
combined two or more individual systems were conducted to verify the compatibility 
of the operational procedures of the combined systems. The facilities used to verify 
flight procedures are listed in table n. 

Mission simulations with the Mission Control Center and the Manned Space Flight 
Network in the simulation loop verified flight procedures for critical mission phases 
and maneuvers. For example, air-to-ground communications were tested in a highly 
elaborate simulation that included ground- tracking coverage and network functions, 
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TABLE n. - FLIGHT PROCEDURES VERIFICATION FACILITIES 


Procedure 

Facility 

Launch and translunar injection 

Command module simulator (mission 
simulation) 

Dynamic crew procedures simulator 

Rendezvous 

Command module simulator 
Lunar module simulator (mission 
simulation) 

Command module procedures simulator 
Lunar module procedures simulator 
Docking trainer 

Entry 

Command module simulator 
Dynamic crew procedures simulator 
Command module procedures simulator 

Lunar ascent 

Lunar module simulator 

Lunar module procedures simulator 

Docking trainer 

Lunar descent 

Lunar module simulator 

Lunar module procedures simulator 

Lunar landing training vehicle 


spacecraft trajectories, telemetry, up-link and voice communications, and all major 
spacecraft systems operations. The simulation was accomplished by coupling the 
Apollo mission simulator (the spacecraft simulator of the highest fidelity available) to 
a simulation of the Manned Space Flight Network. The Mission Control Center was 
used to verify the procedures and to provide training for flight crews and ground- 
support personnel. Additional verification of flight crew procedures was developed 
with the completion of each Apollo mission. Flight crew debriefings included the re- 
cording of crew procedures information that served as either a validation of the exist- 
ing procedures or a basis for improvement of the procedures for the next mission. 


Documentation 

Systems procedures were developed, tested, and verified for each Apollo space- 
craft and documented in the respective Apollo Operations Handbook (AOH). The oper- 
ational procedures were organized within the handbook under normal /backup procedures 
and under contingency procedures. Abort, malfunction, and emergency procedures 
were subclassified under contingency procedures. The AOH was issued 9 months be- 
fore a scheduled mission and was updated 7 months before launch. 
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Flight procedures were produced by integrating specific mission rules and re- 
quirements with the procedures from the AOH. Final flight procedures were developed 
for each mission phase, and the flight procedures for a specific mission were com- 
bined and integrated into the flight plan. 

The number of mission phases covered by flight procedures increased as ren- 
dezvous and lunar activities were added to the mission goals. The flight procedures 
documents included launch-abort, rendezvous, lunar descent and ascent, and earth- 
entry procedures. To ensure the acquisition of useful documentation, it was essential 
that procedures be developed on a timely schedule. Preliminary drafts of the proce- 
dures were prepared for test and review cycles. Final procedures were prepared for 
crew training and for inputs to the data packages and checklists used on board the 
spacecraft. Flight procedures were validated 5 months before launch, and final docu- 
ments were issued 3 months before launch. The preliminary flight plan was issued 
4 months before launch, and the final flight plan was issued 2 months before launch. 
Onboard data packages used by each mission crew were prepared from the AOH, the 
flight procedures, and the final flight plans. 


Change Controls 

Crew procedures for operating spacecraft systems were closely interrelated 
and interdependent. Often, the changing of a certain procedure would affect other pro- 
cedures, crew training, or activity schedules. As a result of this interdependence, 
overall control of procedural changes was critical. Three levels of procedures con- 
trol were established: first, the branch chief of the organization responsible for a 
particular procedures document; second, the Crew Procedures Control Board; and, 
third, the Apollo Configuration Control Board. 

For each proposed change, the branch chief responsible for the specific proce- 
dure provided relevant information from earlier manned space flights: the relation- 
ship between the proposed change and the existing procedure; definitions of any 
conflicts involving spacecraft capabilities, propellant budgets, mission rules, tra- 
jectories, or abort criteria or limits; and a plan for resolving any conflicts. 

The Crew Procedures Control Board was authorized to approve changes that 
affected crew training schedules, onboard data packages, or mission simulators. The 
board, chaired by the Director of Flight Crew Operations, was composed of repre- 
sentatives from the Apollo Spacecraft Program Office and from each directorate of the 
NASA Lyndon B. Johnson Space Center (JSC), formerly the Manned Spacecraft Center 
(MSC). For the Apollo 11 mission, this board met weekly to consider proposed changes 
in crew procedures. The Apollo Configuration Control Board was responsible for auth- 
orizing any change that altered mission objectives; necessitated changes in spacecraft 
hardware or software; resulted in a change to a mission rule, trajectory, or limit line; 
increased a propellant requirement or spacecraft weight; or affected the launch schedule. 

The normal Crew Procedures Control Board process proved adequate for review, 
approval, and implementation of proposed changes until approximately 1 month before 
launch. From then on there was insufficient time for the entire review process to be 
accomplished. The few changes proposed within the last month were transmitted 
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directly to the Director of Flight Crew Operations, who was frequently in contact with 
the flight crew and key personnel from the other organizations affected. This method 
provided adequate consideration for all proposed procedural changes with minimal 
delay. 


APOLLO OPERATIONS HANDBOOK 


Detailed descriptive material on the spacecraft systems and equipment was pub- 
lished in volume 1 of the AOH. Volume 2, bound separately, contained basic flight 
crew procedures for operating all spacecraft systems. The prime contractors for the 
command and service module (CSM) and the lunar module (LM) prepared the initial 
operational procedures. Two issues of the handbook were produced and updated for 
each mission: one for the CSM and one for the LM. Each issue contained the two vol- 
umes described previously. The systems procedures in the handbook consisted of 
normal /backup procedures and contingency procedures. Normal procedures were used 
when all systems were operating properly. Backup procedures were applicable if a 
system failure or some other anomaly prevented the use of normal procedures. Con- 
tingency procedures consisted of actions to be taken for abnormal situations that might 
occur during the missions. These procedures enabled the crew to abort the mission, 
implement an alternate mission, or continue the planned mission under degraded con- 
ditions. The contingency procedures, consisting of necessary immediate actions and 
the limitations that might be imposed on subsequent activities from such actions, were 
divided into three classes: abort procedures (considered a specialized form of backup 
procedures involving early mission termination); malfunction procedures (encompassing 
recognition and diagnosis of system malfunctions and appropriate corrective action); 
and emergency procedures (procedures other than abort procedures that would require 
instant implementation if the crew were in immediate danger). 

The AOH was written to accommodate differences in specific spacecraft. Changes 
and updates were made by changing pages or reissuing the entire handbook. The CSM 
handbook contained certain pages applicable only to specific vehicles or selected series 
of vehicles. Therefore, some pages were repeated in modified form to reflect mate- 
rial unique to specific vehicles. A manual for use on a specific vehicle could thus be 
prepared by supplementing a complete set of common pages with pages marked specif- 
ically for that vehicle. The LM handbook was similarly written. 


Normal/Backup Procedures 

Systems procedures for normal /backup operations were presented in the AOH in 
tabular form and in numerical sequence. An example of a page from the normal/backup 
procedures section of the CSM handbook is shown in figure 3(a). The column headings 
were STA/T (station/time), STEP, PROCEDURE, PANEL, and REMARKS. An exam- 
ple of the LM handbook format, which was slightly different from that of the CSM hand- 
book, is shown in figure 3(b). The column headings were CREWMAN, PNL (panel), 
PROCEDURES, and REMARKS. 
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(b) Lunar module. 



Explanations of the column headings are as follows. 

1. The term STA (or CREWMAN) designated the crewmember assigned to the 
spacecraft location where the procedure or step was performed. Station CDR, CMP, 
and LMP represented the commander, the command module pilot, and the lunar mod- 
ule pilot, respectively, and corresponded to the left, middle, and right positions of the 
crewmen in the vehicle. The designation CMP also pertained to the activities per- 
formed in the lower equipment bays, which were inaccessible to the other crewmem- 
bers. The time column (T) contained mission time, event time, or altitudes. 

2. The term STEP designated the numerical position of elements within a se- 
quence of events forming a complete procedure. The LM handbook did not show step 
numbers in a separate column. 

3. The term PROCEDURE was used to designate the group of steps or the over- 
all task involved in performing a complete function or operation. The CSM backup 
procedures relative to a preceding step were indicated with a perimeter of X’s around 
the backup procedure. The LM backup procedures consisted of alternatives listed in 
the same procedure. 

4. The term PANEL was used to designate the particular control or display in- 
volved in a given procedure by number. For example, in the CSM, the main display 
console panels were numbered from 1 to 12. The panels in the lower, right-hand, and 
left-hand lower equipment bays were numbered from 100 to 164, 225 to 278, and 325 
to 382, respectively. Charts of all panel control locations were included as an appen- 
dix to the handbook. 

5. The term REMARKS was used to provide the rationale and explanations for 
the particular procedure. Remarks considered important to the performance of pro- 
cedures were generally included in the PROCEDURE column as WARNING or CAUTION 
notes, depending on the severity of the situation. In some cases, a remark was labeled 
NOTE. 

Volume 2, containing overall coverage of the procedures with supporting ration- 
ale, became the repository of comprehensive systems procedures and was used as a 
reference base line for the abbreviated checklists and for the use of support personnel 
recently assigned to the program. The CSM systems procedures were written con- 
cerning the subjects listed in table III. 
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TABLE HI. - HANDBOOK CONTENTS FOR CSM SYSTEMS PROCEDURES 


Subject 

Typical no. of pages 

Backup crew prelaunch checks 

34 

Prime crew prelaunch checks 

17 

Boost and insertion 

17 

Lunar module interfaces 

59 

Rendezvous 

73 

Systems management 

101 

Guidance and control reference data 

53 

Guidance and control reference modes 

25 

Guidance and control general procedures 

53 

Alinements 

39 

Coasting 

23 

Orbit change vehicle preparation 

2 

Guidance and navigation orbit change 

33 

Stabilization and control system orbit change 

17 

Deorbit and entry of lunar- return- entry vehicle preparation 

15 

Guidance and navigation deorbit and entry 

57 

Stabilization and control system deorbit and entry 

25 

Earth- landing phase (less than 50 000 ft) 

7 

Postlanding 

13 

Mission test requirements 

1 

Abort procedures 

50 

Malfunction procedures 

83 

Emergency procedures 

21 

Total 

818 


Malfunction Procedures 

Malfunction procedures were used by the crew to correct or isolate off-nominal 
conditions, which were indicated by displays, caution and warning lights, or the ab- 
sence of a scheduled function or event. Where the procedures for multiple or complex 
symptoms would become too numerous and unmanageable, malfunction procedures 
were usually designed to cover significant single' symptoms. 

Malfunction procedures were presented in logic-flow diagram format and were 
arranged by symptoms, as shown in figure 4. The primary malfunction procedures 
(symptom routines) were supplemented by special subroutines and system- 
reconfiguration subroutines where necessary. A three- column format was used for 
symptom- routine, logic-flow diagrams. 
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Figure 4. - Example of malfunction procedures in the AOH 










Emergency Procedures 


Emergency procedures were provided for quick alleviation of flight-hazardous 
or time- critical situations. Ordinarily, an emergency condition would be physically 
sensed by the crew, rather than being brought to their attention by warning signals or 
by voice communications from the mission controllers. Emergency procedures were 
prepared for the following possible problem areas. 

1. Prelaunch emergencies that required rapid hatch opening 

2. Flight emergencies including fire or smoke in the command module (CM) 
during boost, orbit, or entry phases; contamination in the CM; contamination in the 
suit while being worn by the crewman; failure of the launch escape tower to jettison; 
reinstallation of the forward hatch impeded; premature emergency safing of apex- 
cover jettison; one couch Y- strut not fully extended or locked; and failure of the CM 
reaction control system (RCS) to pressurize or to provide propellant 

3. Postlanding (earth) emergencies involving fire or smoke in the CM 


Lunar Module Malfunction Procedures 

The original LM malfunction procedures prepared by the contractor were ar- 
ranged in a four- column format (SYMPTOM, FAILURE, PROCEDURES, and RE- 
MARKS) similar to that used on Gemini missions. In a review of Apollo procedures, it 
was found that the direct location of failures was not always possible after an indica- 
tion of a failure was received. The crewman had to perform several procedural steps 
before the possible causes of a failure could be separated. Therefore, a new format 
was devised by rewriting a sample malfunction procedure. The columns of the format 
were rearranged to read SYMPTOM, PROCEDURE, NEXT STEP, REMARKS, and 
FAILURE. Later, the format was further changed from a line-by-line to a block 
format. 

After the format was changed, an extensive effort to write a complete set of mal- 
function procedures for the LM was begun. The contractor made a parallel effort. It 
was decided that, to cover every situation completely, all symptoms that could be de- 
tected should be listed. In addition, every possible failure and the resulting symptom 
should be listed for each component. The two lists should then be combined to group 
each possible failure under the appropriate symptom. 

Because of redundancy, however, some component failures would not result in 
failure symptoms; likewise, a certain symptom was possible, although no failure ex- 
isted that could produce the symptom. For example, a cold soak in a pressurized 
ascent propulsion system would not cause a low ullage-pressure reading (because the 
regulators would make up the pressure), but a low-pressure reading would occur if the 
ascent propulsion system were unpressurized. 

Another area in which procedures were documented was that of the LM check- 
lists or, more correctly, the LM onboard data. The onboard data were prepared 
from procedures in the handbook and were tailored for each specific mission. It was 
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most important that the onboard data be available for review by systems engineers for 
technical accuracy and consistency, which constituted the greatest problems in pro- 
cedures preparation. Availability of the onboard data and coordination between the 
systems engineer, the crewman, the hardware engineers, and the flight controllers 
greatly reduced these problems. 


SYSTEMS PROCEDURES 


The procedures for the use of the spacecraft systems were, by definition, in- 
dependent of the type of mission and were developed through an evolutionary process 
of design, analysis, and use. Unforeseen problems and unique situations that occurred 
during testing and operations resulted in corrections or changes in the systems pro- 
cedures and, in some cases, improvements or changes in the hardware configuration. 

Procedures were written to describe flight crew operations for each of the major 
systems of each spacecraft. The spacecraft systems procedures and the major prob- 
lems encountered in their development are described in the following sections. 


Attitude Control 

Orbital operations . - Orbital operations included rendezvous and optics tracking. 
Rendezvous required both coasting flight and RCS thrusting. Automatic attitude con- 
trol was normally used for main- engine burns in rendezvous operations; however, 
manual override was made possible by moving the attitude controller out of detent. 

For RCS thrusting, automatic pointing was available only for rotation to the initial ig- 
nition attitude. The digital autopilot attitude-hold mode controlled the spacecraft atti- 
tude during RCS maneuvers. Pulse- mode control of coasting flight during rendezvous 
was used to conserve propellant and because rapid, precise maneuver changes were 
rarely required. 

Lunar descent . - The lunar landing presented several unique problems that re- 
quired special consideration in the development of attitude control. 

1 . During descent, freedom to rotate the LM around the thrust axis (X axis) 
was necessary to provide downward and upward visibility and to adjust the attitude of 
the antenna for optimum communications with earth. To satisfy this requirement, the 
yaw channel of the rotational controller was made active while the remaining channels 
remained under automatic attitude control. Because the attitude was constrained at 
lower altitudes to ensure landing radar lock, automatic attitude control was available 
only at altitudes above 30 000 feet. 

2. The capability to redesignate the location of the computer- stored landing site 
was incorporated into the attitude control system to provide terrain avoidance without 
switching out of the automatic mode. Redesignation was accomplished by moving the 
controller out of detent in the pitch axis for up- range or down- range movements, and 
out of detent in the roll axis for lateral movements. The computer interpreted each 
detent signal as a target position increment and initiated the proper attitude commands 
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3. During final descent, the sink rate could be controlled by a rate-of-descent 
mode, which maintained a fixed vertical component of velocity. The components were 
in 1-ft/sec intervals and were controlled by means of the rate-of-descent switch. 

The manual attitude control (using the attitude-hold mode) was used to control forward 
and lateral velocity during the final descent. 

4. The normal attitude- hold mode, in which the throttle controls the percentage 
of thrust, was also available during descent. 

An undesirable design characteristic of the LM digital autopilot was that, at lunar 
touchdown and thrust termination, the attitude jets fired automatically in an attempt to 
return the LM to the pretouchdown attitude. Workaround procedures and software 
fixes were implemented to correct this firing problem. On the Apollo 11 mission, the 
flight crew moved the hand controller momentarily out of detent immediately after the 
LM had settled on the surface, thus sending a discrete signal to the computer, which 
established a new attitude reference and terminated thruster activity. For subsequent 
missions, a software change that accomplished the same purpose by means of a key- 
board entry was implemented to simplify the procedure. 

Entry . - Development of attitude control for earth entry presented a unique prob- 
lem because of vehicle dynamics introduced by aerodynamic forces. Although the con- 
figuration of the CM was stable and tended to trim in two axes, the damping ratio was 
low. Therefore, the main control- system requirement in pitch and yaw was to damp 
oscillatory motion. Cross- range and down- range locations of the landing point were 
controlled by rotating the aerodynamic lift vector out of the entry plane; thus, an 
attitude-hold mode was required in the roll axis. The normal attitude- control mode 
for entry was fully automatic. The preferred backup to the automatic mode was man- 
ual damping of pitch and yaw oscillations by means of rate- command and manual con- 
trol of roll attitude with the attitude- hold mode. 

Platform alinement . - Optics-tracking modes were designed to include accu- 
rately controlled rotations for pointing the optics at selected stars, closing on a drift- 
ing rendezvous target, or locating landmarks. Automatic maneuvering to point the 
optics at preselected stars was desirable to conserve propellant and to minimize the 
time required to locate stars for platform alinement. Because landmarks passed 
from horizon to horizon at a nonlinear rate, a special automatic pointing capability was 
added to the CM for tracking landmarks from low orbits. Typical tracking rates varied 
from near 0 to 5 deg/sec during a single pass. The automatic capability was achieved 
by use of the knowledge in the spacecraft computer concerning the location of the land- 
mark relative to the inertial guidance frame. The attitude of the CM was changed auto- 
matically to point the optics along the computed line of sight. The only task remaining 
for the crewmen was removing any error encountered in pointing with the optics con- 
troller. A list of the preferred attitude- control modes for each major function of 
orbital flight is shown in table IV. 

A technique for orienting the spacecraft to a known inertial attitude and alining 
the reference system to the spacecraft was developed for use in the event that the CM 
onboard computer failed. The procedure for orienting the spacecraft was to set the 
optics to a fixed position and then to maneuver the spacecraft so as to center two known 
stars in the crosshairs of the scanning telescope. 
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TABLE IV.- ORBITAL-ATTITUDE-CONTROL MODES 


Requirement 

Preferred control mode 
(a) 

Automatic 

Attitude 

hold 

Pulse 

Direct 

(manual) 

Rotation to thrust attitude 

1 

4 

2 

3 

Translation using main engine 

1 

2 

(b) 

3 

Translation using reaction control 
system 

(c) 

1 

(b) 

2 

Braking and line-of-sight control 

(c) 

1 

(b) 

2 

Boresight on target vehicle 

3 

2 

1 

4 

Track landmarks 

1 

3 

2 

4 

Rotation to track stars 

(c) 

2 

1 

3 


lumbers indicate order of preference. 
°Not used. 
c Not available. 


The normal procedures for the alinement of the inertial measurement unit on the 
lunar surface required a high degree of crew participation. The procedures involved 
the use of a pair of telescopic sightings of each of two stars, and, to minimize opera- 
tor error, repetitive sightings on each star. A faster technique for alinement was 
needed to expedite emergency lift-off procedures in a time-critical situation. The 
following methods were investigated: use of a star and gravity, use of previously 
stored attitude and gravity, and use of a ground- calculated alinement matrix and grav- 
ity. The star- and- gravity method was rejected because a telescopic star sighting was 
required. The stored- attitude- and- gravity method, although requiring little crew par- 
ticipation, was rejected because the stored attitude would not be retained by the com- 
puter during power-off operations. The ground-calculated-matrix-and-gravity method 
was adopted because it required only a minimum of crew participation and also offered 
flexibility: any number of usable matrices could be calculated and transmitted from 
the earth to the LM computer. Use of a ground- calculated alinement matrix and 
gravity permitted the crew to devote more time to activating ascent consumables such 
as electrical power, water, oxygen, and propellants. After the data up link was com- 
pleted, the crew selected the alinement programs and completed the alinement with 
minimum effort. 
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Computers 

The methods by which various parameters were put into the guidance computer 
and displayed to Apollo crewmen were as follows. 

1 . Inputs could be made through such cockpit controls as switches and hand 
controllers, either as discrete signals or as analog inputs to a digital-conversion 
device. 

2. Inputs could be made directly, in alphanumeric form, through the computer 
keyboard. 

Examples of unique input devices are the MARK and MARK REJECT buttons for star 
or landmark navigation sightings; the rate-of- descent switch for incrementing or dec- 
rementing the descent- rate counter; and the landing- point-designator function of the 
hand controller, which caused the computer to redesignate the location of the lunar 
landing site. The flexibility provided by the facility for making direct inputs through 
the keyboard was a valuable feature in Apollo guidance procedures. Problems were 
solved, and changing requirements were met with procedural changes or with inex- 
pensive software changes, rather than with costly hardware changes. 

Information from the Apollo guidance system was presented to the flight crews 
by one of the following methods. 

1 . A display in numerical form on the computer keyboard 

2. Lights illuminated by computer- generated discrete signals 

3. Analog displays driven by computer information 

Alarm codes. - The computer program for the LM contained almost 100 different 
alarm codes that could be displayed by the keyboard to indicate a procedural or sys- 
tem deviation to the crew. The alarms were divided into routine and priority group- 
ings. A routine alarm was indicative of a non- time- critical situation and illuminated 
a PROGRAM light, rather than removing the displayed information from the keyboard. 
The crewman would later call the alarm for display and diagnosis. A priority alarm 
flashed the PROGRAM light immediately, removed any previously displayed data from 
the keyboard, and notified the crew whether the alarm condition caused a software re- 
start, termination of the current program, or neither. 

Fault detection. - The possibility of error existed for any onboard computer func- 
tion. The principal causes of these errors were computer hardware failures, input 
data error, and algorithmic error (from such functions as roundoff and quantization). 
The first category of error, hardware failure, was detectable by means of several 
methods, including the caution and warning system, computer status lights, and a 
computer self-test. Input data errors and algorithmic errors were not so easily de- 
tected, and one or more methods of cross-checking were necessary to verify computed 
results. In the case of the LM backup guidance computer, computed results were com- 
pared with predetermined threshold values. This comparison had the disadvantage of 
requiring that the crew procedures be lengthened to include reading out and verifying 
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computed quantities. For example, the procedure for calibrating gyroscopes and ac- 
celerometers required read-out of 12 quantities for verification purposes. This activ- 
ity was not essential to performing the calibration function but was necessary only to 
guard against error. Furthermore, the time required for this method precluded its 
use in time-critical situations. 

The primary guidance computers used a more complex implementation of cross- 
checking. The threshold values were internally stored, and the computer performed 
the comparison automatically. Although requiring more computer memory, this im- 
plementation was much faster than read-out verification, which allowed its use in 
time-critical situations, and relieved the crew of performing tasks not essential to a 
mission function. However, even these more complex techniques were incomplete. 

The error information displayed to the crew was in cryptic form, so that once the sys- 
tem detected an error, the crew was still faced with the task of interpreting the error 
information. It was necessary during Apollo flights to spend considerable time and 
effort in generating and maintaining error-interpretive aids, including malfunction 
procedures and alarm- code decals. More importantly, a considerable portion of crew 
training time had to be devoted to exercising and refining these aids. Most, if not all, 
of these aids could have been programed into the computer. This procedure, which 
would have relieved the crew of the task of interpreting error information, would have 
shortened training time and would have been valuable in time- critical situations. 


Electrical Power 

Displays . - Onboard displays of current and voltage statuses were needed to moni- 
tor the performance and condition of spacecraft batteries and fuel cells. The displays 
in the Apollo spacecraft are summarized in table V. Fuel cells required other onboard 
displays in addition to current and voltage. The flight crews monitored the quantities 
and pressures of the cryogenic reactants to assess the integrity and performance of the 
reactants supply system. Internal fuel cell reactant pressures, pressure differentials 
and temperatures were used by the flight crews in determining fuel cell condition. 

Voltage and current read-outs for the main power-distribution buses were most 
desirable; however, monitoring of these displays by the flight crews had to be time- 
shared and was often relegated to system- management periods. Thus, an alarm or 
warning signal was needed to inform the flight crew of an out- of- tolerance main-bus 
voltage. Power- source characteristics made an alarm necessary only for undervolt- 
ages. The requirement for immediate corrective actions resulted primarily from the 
sensitivity of most guidance- system components to low voltages. The onboard assess- 
ment of the Apollo main-bus load- sharing and possible malfunction analysis of short- 
ing on main buses was hampered because main-bus currents were not displayed. 
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TABLE V.- ELECTRICAL POWER SYSTEM DISPLAYS 


Parameter 

CSM 

LM 

Power distribution 

Direct-current amperage 

No 

No 

Direct-current voltage 

Yes 

Yes 

Direct-current low-voltage light 

Yes 

Yes 

Alternating-current amperage 

No 

No 

Alternating- current voltage 

Yes 

Yes 

Alternating-current low-voltage light 

Yes 

Yes 

Alternating-current high-voltage light 

Yes 

No 

Alternating-current overload light 

Yes 

No 

Alternating- current frequency 

No 

No 

Battery to main-bus light 

No 

No 

Power conversion 

Inverter current 

No 

No 

Inverter voltage 

No 

No 

Inverter temperature 

Light only 

No 

Battery-charger current 

Yes 

(a) 

Battery-charger voltage 

Yes 

(a) 

Power supply 

Battery current 

Yes 

Yes 

Battery voltage 

Yes 

Yes 


^ot applicable. 


Procedures . - Apollo spacecraft displays were most useful when the power for 
the displays and the power for the functions came from separate sources. Power for 
the fuel cell radiator bypass valve and for the display indicating the position of the 
valve was supplied from the fuel cell radiator circuit breaker as shown in the upper 
portion of figure 5. To protect against closure of the fuel cell radiator bypass valve 
by inadvertent bumping or vibration of the fuel cell radiator bypass switch, a crewman 
opened the fuel cell radiator circuit breaker. With this circuit breaker open, however, 
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power was also removed from the display 
that indicated a successful power trans- 
fer. Inverters had caution and warning 
sensing circuits that initiated alarms if 
the inverter transfers were not correct. 
However, when the spacecraft batteries 
were connected to the main buses with 
motor switches, no indications of the 
transfer were available. During critical 
phases of the mission (such as the entry), 
voltage or current readings were moni- 
tored by the crewmen to ensure that 
appropriate power transfers were 
accomplished. 


Environmental Control 


Operation . - Environmental control 
for the CSM consisted of regulating the 
pressure and temperature of the cabin and 
suit gases; maintaining the desired humid- 
ity by removing excess water from cabin 
and suit gases; controlling the level of contamination of the gases by removing carbon 
dioxide, odors, and particulate matter; and ventilating the cabin after landing. During 
the boost phase, the cabin was vented to a total pressure of less than 5. 6 psia. An 
inflight oxygen purge through an overboard vent resulted in an oxygen enrichment of 
the cabin. 

The flight crew was fully suited during launch and critical mission phases; how- 
ever, the shirt sleeve suit configuration was used for other phases, including entry. 
Though it was originally planned to disconnect the suit oxygen umbilicals at the envi- 
ronmental control unit (ECU) hose- connector assembly during suit-doffing operations, 
tests revealed that the hose disconnect and reconnect forces were of sufficient magni- 
tude that the crew’s ability to perform this task at zero g was questionable. The 
oxygen- supply ports of the ECU hose- connector assembly (suit hoses disconnected and 
the control lever in the cabin flow position) were so noisy that intercrew communica- 
tions during the unsuited mode were difficult or impossible. It was found that leaving 
all suit hoses intact at the ECU connector assemblies and disconnecting at the pressure 
suit lowered the noise level by 6 to 8 decibels in the speech- interference range. Pro- 
cedures were prepared to keep the suit hoses connected to the panel assemblies at all 
times except during doffing (when suit oxygen hoses were disconnected). Suit-donning 
time in the event of emergency was minimized, and the integrity of the suit hose and 
panel-connector-assembly interlocks was maintained, as verified by prelaunch ground 
tests. Inflight use of cabin fans for forced convection was not required because cabin 
air was drawn into the suit circuit, thereby controlling the cabin humidity, tempera- 
ture, and level of carbon dioxide. The suit fans were active during all mission modes. 

Water management consisted of collecting, sterilizing, and storing potable 
water produced by the fuel cells. The water was delivered chilled or heated for crew 
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Figure 5. - Example of Apollo electrical 
power displays. 
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consumption. The excess potable water was either transferred to the waste water sys- 
tem for boiling or dumped overboard. The water was chlorinated periodically during 
flight to control bacterial growth. 

The CM was designed to provide a comfortable environment for a 48- hour period 
after splashdown. Two electrically actuated gate valves located in the tunnel area 
were opened after splashdown. A fan on the intake valve provided forced cabin ventila- 
tion, and air was vented overboard through the exhaust valve. A distribution duct was 
affixed to the main- display- console outlets to provide individual cooling ports for each 
crewman. The inlet and outlet gate valves were automatically closed if the spacecraft 
attitude allowed sea water to enter the cabin. 

Problem areas . - Relatively few problems were encountered in environmental 
control system procedures with the Apollo spacecraft. The following are examples of 
some problems and solutions. 

1 . Buildup of hydrogen gas (generated by the fuel cells) within the CM environ- 
mental control system presented two potential problems during early Apollo flights: 
diffusion of hydrogen collected in the water tank through the bladder into the oxygen 
pressurization gas, and hydrogen gas in the drinking water during closed-loop suit 
operation. The first problem was corrected by providing a very low continuous purge 
(0. 032 lb/hr) of the bladder pressurization gas. The second problem was solved by 
introducing operational procedures to purge the suit circuit with 100-percent oxygen, 
thereby reducing the hydrogen concentration level by venting any hydrogen buildup into 
the larger cabin volume. In addition, a hydrogen separator was added to the water 
subsystem. 

2. The CM cabin fans are not required for forced air convection at zero g. Be- 
cause of excessive acoustic noise, the fans have not been operated on lunar missions. 
The exhaust oxygen hose (shirt-sleeve mode) provides adequate mixing of cabin gases 
and may be used to eliminate local areas of condensate buildup. 

3. The CM cabin heat exchanger is ineffectual in controlling the cabin tempera- 
ture. The thermal lag is of such a duration that the cabin temperature control exer- 
cised by the heat exchanger is masked by other thermal effects. It was determined 
that cabin temperature is a function of the spacecraft power load and vehicle attitude. 

4. Inspiration of toxic fumes during CM RCS propellant burnoff and dump (after 
main-parachute deployment) was considered a hazard to the flight crew. It was planned 
that the crew remain fully suited with a suit pressure slightly higher than cabin pres- 
sure to preclude inspiration of these fumes. In-flow valves were cycled to prevent 
fume entry into the cabin. It was determined that the contaminant level is slight; nor- 
mal entry without the pressure garments has been demonstrated. 
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Propulsion 


Operating procedures were essentially completed before the first manned flight; 
however, hardware development and testing necessitated procedural changes. The 
following is a summary of some of the procedural changes. 

1 . The service propulsion system (SPS) (fig. 6) had redundant propellant supply 
paths (bores). Before the first manned flight, the decision was made to operate the 
systems in the dual-bore mode for critical burns such as deorbit. Because the engine 
had been tested using only the single-bore mode for starts, additional tests were nec- 
essary. The data from these tests uncovered a potential problem: considerable over- 
shoot (overpressure) in the thrust level at ignition was experienced when the dual-bore 
mode was used for starts, and the increased thrust levels could induce loads into the 
spacecraft-tunnel interface that would exceed design limits for docked burns. The 
operating procedures were then changed to start the engine by using the single-bore 
mode and to open the redundant bore several seconds later. 

2. The propellant utilization and gaging system in the SPS provided the crew 
with read-outs of oxidizer and fuel quantities and with an indication of propellant un- 
balance. By use of an oxidizer flow-control valve, the crew could correct propellant 
unbalance once it occurred. To check this system adequately, a long-duration burn of 
the service propulsion engine was required. No long-duration burns were planned 
during the Apollo 7 flight, and the system was deactivated on the Apollo 8 flight because 
of a sensor failure. The system was not checked until the Apollo 9 and 10 flights. Dur- 
ing these flights, two problem areas were discovered: a time delay, incorporated in the 
system to allow the propellants time to settle before the quantity was displayed, was 

insufficient; and a bias input to the sys- 
tem, to correct for an inherent problem 
and unexpected fluid-flow characteris- 
tics, resulted in erroneous propellant 
quantity and unbalance read-outs for the 
flight crew. The operating procedures 
were changed; and, by the time of the 
Apollo 11 flight, the procedures were well 
defined. 


3. The flight combustion- stability 
monitor was incorporated into the orig- 
inal design to protect the SPS against 
rough or unstable ignition. The monitor 
would cause automatic engine shutdown 
should ignition problems develop. Be- 
fore the Apollo 7 flight, the engine in- 
jector was redesigned, and the problem 
of unstable ignition was virtually elim- 
inated. The procedures for using the 
monitor were changed, and the automatic 
shutdown mechanism was disabled for 
the first three manned flights. The entire 
monitor was removed from later spacecraft. 


Oxidizer 


fuel 



Figure 6. - Apollo SPS. 


24 




In several instances, hardware was developed and tested with incomplete knowl- 
edge of how it would be operated, resulting in restrictions and limitations on the oper- 
ation of the propulsion systems. For future programs, every effort should be made to 
have all systems totally operational during the early system- evaluation flights. Full 
fuel loads and burns of adequate length should be planned to verify both hardware and 
procedures. 


FLIGHT PROCEDURES 


The developmental techniques used to prepare flight procedures documents have 
been discussed in a preceding section of this report. The preliminary and final edi- 
tions of each type of flight procedure for the manned Apollo missions are listed in 
table VI. 


TABLE VI. - FLIGHT PROCEDURES PUBLICATION SCHEDULE 


Document 

Edition of 
document 

Publication dates by mission 
(a) 

Apollo 7 
(Oct. 11, 1968) 

Apollo 8 
(Dec. 21, 1968) 

Apollo 9 
(Mar. 3, 1969) 

Apollo 10 
(Apr. 18, 1969) 

Apollo 11 
(July 16, 1969) 

Abort summary 

Preliminary 

Nov. 15, 1967 

Oct. 11, 1968 

Nov. 25, 1968 

Feb. 3, 1969 

Mar. 17, 1969 


Final 

Apr. 15, 1968 

Oct. 29, 1968 

Jan. 17, 1969 

Mar. 17, 1969 

May 22, 1969 

LM rendezvous procedures 

Preliminary 

(b) 

(b) 

June 13, 1968 

Feb. 1, 1969 

Mar. 17, 1969 


Final 



Dec. 3, 1968 

Mar. 17, 1969 

May 16, 1969 

CSM rendezvous procedures 

Preliminary 

Apr. 29, 1968 

(b) 

July 19, 1968 

Jan. 23, 1969 

Mar. 17, 1969 


Final 

June 21, 1968 


Feb. 1, 1969 

Mar. 17, 1969 

May 15, 1969 

Lunar descent and ascent 

Preliminary 

(b) 

(b) 

(b) 

Feb. 12, 1969 

Mar. 17, 1969 

procedures 

I 

Final 




Mar. 17, 1969 

May 22, 1969 

Entry summary 

Preliminary 

Mar. 6, 1968 

(b) 

Aug. 19, 1968 

Jan. 20, 1969 

Mar. 17, 1969 


Final 

June 24, 1968 

Oct. 29, 1968 

Dec. 23, 1968 

Mar. 17, 1969 

May 15, 1969 


^Numbers in parentheses are mission launch dates. 
b Not applicable. 


Launch and Translunar Injection 

Launch into earth orbit . - The Saturn launch vehicles were designed specifically 
for manned space flight, and system redundancy was designed into all parts of the 
vehicle. The primary crew task during the launch phase was to monitor the space ve- 
hicle for failures that might affect crew safety or mission success. A decision to abort 
the mission manually would have to be based on reliable data; therefore, detailed analy- 
ses of failure mode effects on all vehicle systems were formulated and evaluated by an 
inter-Center crew-safety panel. Limits were defined for spacecraft attitude, rate of 
change in attitude, and error of attitude readings. Limits were set for the angle of 
attack of the spacecraft to give the crew an adequate warning of possible structural 
breakup. In case of breakup, the crew would initiate abort procedures manually. 
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The important system parameters were monitored by ground- support personnel 
by telemetry. The time required for ground response was at least 15 seconds. This 
delay and the lack of some telemetry were acceptable for measuring and responding to 
slow deviations in attitude such as inertial platform drift; but, for rapid failures, the 
crew was provided with onboard displays for rapid response. The crew would abort 
if the onboard data for two separate parameters indicated that a failure had occurred 
and that an abort limit had been exceeded. The requirement for two separate indica- 
tions of failure was necessary to guard against an instrumentation failure and the un- 
necessary initiation of a manual abort. However, preliminary studies indicated that 
the Saturn V vehicle could not withstand two S-IC engine failures from either a struc- 
tural or a control standpoint; therefore, an automatic abort system was incorporated 
into the basic design. The automatic abort limit for the triply redundant (voted two of 
three) sensors was identical to the manual abort limit. The automatic abort system 
was deactivated just before the S-IC/S-n staging. 

Malfunction procedures: Certain malfunctions of the launch vehicle or of the 
spacecraft were considered insufficient cause for abort and, because of systems re- 
dundancy, did not affect crew safety or the success of the mission. An example of 
such a malfunction is the loss of a single engine on the first or second stage of the 
Saturn launch vehicle. Failure of a single engine would not be cause for mission ter- 
mination except for a brief period during the first- stage burn when launch- vehicle con- 
trol problems could occur. The mission ground rules were written to cover all known 
situations and to allow the crew to assess the severity of a malfunction and to decide 
whether abort was required. Many simulations of known malfunctions were performed 
to decide the point of no return. The results of these simulations were distributed to 
the appropriate NASA panels, which established additional abort limits that were in- 
corporated into the flight procedures and were verified by further simulations and 
training. 

Abort procedures: For the launch phase, the abort procedures (fig. 7) were 
divided into four primary modes, using the launch escape tower or the SPS. The 

launch- escape-tower abort mode (mode I) 
was subdivided into three parts (A, B, and 
C), each of which was designed to be fully 
automatic in the postabort sequence. 

Mode IA was primarily a launch- complex 
abort and was in effect from 30 minutes 
before lift-off until 42 seconds after lift- 
off. The transition to mode IB was ac- 
complished by activation of a timer to 
change the postabort computer logic. The 
RCS propellants were dumped rapidly 
through the aft heat shield for the mode IA 
abort because at that point the spacecraft 
would be too low to expel the propellants 
by conventional methods. In a mode IB 
abort, a canard system located on the 
launch escape tower would be used for 
spacecraft orientation. The transition to 
mode IC was dependent only on attaining 
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an altitude of 100 000 feet where the canard system was not effective and where the 
spacecraft tumble rate could be controlled manually by the crew. The options of jet- 
tisoning the tower and of reorienting the spacecraft manually for a manual (normal) 
entry were retained in mode IC. These options were allowable only when the body 
rates were under control and when the attitude reference system was usable. The flight 
procedures were written to follow the designed automatic abort modes with the crew 
monitoring all critical events. Thus, if the automatic sequence for abort failed, the 
crew would initiate an abort by manually executing the critical backup functions listed 
in the checklist procedures. 

The SPS was to be used for abort modes during the portion of the launch phase 
occurring above the sensible atmosphere of the earth. Mode II consisted of spacecraft 
separation, reorientation, and entry with all events manually controlled by the CDR. 
Mode III involved a retroburn of the SPS. The retroburn was required to avoid a land- 
ing in Africa and to target the spacecraft for a planned recovery area. A mode m 
abort was considered highly unlikely because of overlaps between modes n and IV and 
because multiple system failures would be required for this type of abort. A mode IV 
abort was an insertion into earth orbit and was considered the most desirable of the 
abort modes because alternate missions could then be accomplished. The lower 
threshold of the mode IV abort was determined by mission control data and was based 
on the capability of the spacecraft to gain orbit from dispersed conditions during the 
boost phase. All data concerning attitude, time of ignition, and time of burn were to 
be supplied from the ground. The mode IV abort was a fixed-attitude burn on the 
Apollo 7, 8, and 9 missions. 

Transfer of ground responsibility to flight crew: After the successful Apollo 7, 

8, and 9 missions and the attendant increased confidence in the spacecraft systems, 
flight procedures were changed to allow the crew to control vehicle attitudes by con- 
sidering trajectory information provided by the onboard navigational equipment. This 
change greatly increased the efficiency of the maneuver. The use of the SPS for abort 
was therefore advanced by approximately 1 minute for the nominal mission. 

Early procedural problems, caused by late changes and corrections to launch- 
vehicle hardware, were solved, allowing the deletion of some abort criteria. For ex- 
ample, the loss of the launch- vehicle inertial guidance platform was not considered an 
abort criterion after demonstration of the capability of the crew to fly the launch vehicle 
by using the command module computer (CMC). A nominal launch-profile cue card 
(including pitch angle, inertial velocity, rate-of-change altitude, and altitude) was 
carried on board by the crew. These nominal values were adjusted by the crew during 
the flight by using values generated by the onboard computer. Before staging, the ve- 
hicle was guided by a programed tilt maneuver supplied by the CMC. Switchover to 
the backup guidance system was performed by the crew if indications were that the 
launch- vehicle guidance system had failed. During training simulations, each crew 
consistently demonstrated the capability to insert into orbits within 2 miles of the 
nominal altitude. The flight procedure also was expanded to allow the translunar injec- 
tion (TLI) maneuver to be manually controlled following a guidance failure. Many con- 
servative rules concerning the launch vehicle were relaxed as more flight data were 
gathered, and the probability of a successful mission was increased. 
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Translunar injection. - The primary crew task during the TLI maneuver was the 
same as during launch; monitoring the onboard displays. Procedures for aborts dur- 
ing TLI were simplified because the problem of an immediate earth entry did not exist. 
Criteria for mission termination still existed; however, more time was available for 
crew actions if an abort was necessary. The abort limits were excessive attitude 
rates and errors, and the error limits were larger than during launch because the SPS 
was capable of deactivating the earth- entry procedures or of executing maneuvers for 
alternate missions. 

Malfunction procedures for TLI . - Loss of some spacecraft consumables or loss 
of power during the TLI maneuver would require a rapid return to earth, and these 
contingencies were covered by fixed-time aborts. Procedures and data supplied be- 
fore launch were developed and included in the checklist for fixed-time aborts, which 
were planned for 10 minutes and for 90 minutes after the TLI maneuver. After the 
Apollo 10 mission, the abort after 10 minutes was deleted from the mission plans. The 
design of the 90- minute abort plan allowed the return to a contingency landing area in 
less than 18 hours. This period of time was considered sufficient for any foreseeable 
consumables problem. Other malfunctions occurring during or near the time of TLI 
were managed by using alternate mission plans. For failures of a rapid nature, the 
decisionmaking responsibility rested with the crew because ground- control data would 
probably be delayed too long for effective decisions. 

If a complete guidance failure occurred during launch or orbital- coast phases, 
the primary method of starting the TLI maneuver would be inhibited. Backup proce- 
dures, using the onboard CMC to start the S-IVB engine, were incorporated into the 
checklist. 

An approximation of the desired pitch-angle profile taken from the nominal tra- 
jectory was displayed on the attitude indicator by using the orbital- rate- drive capabil- 
ity. Thus, the flight commander’s task was to keep the attitude rate under control 
and the attitude ball zeroed. If required by a dispersed initial orbit, the displayed 
profile could be updated before the maneuver by ground - supplied data. The crew was 
then responsible for controlling vehicle attitude and for shutting off the engine when 
proper inertial velocity was attained. The flight path was monitored continuously by 
using CMC displays, and attitude corrections could be made if necessary. The accu- 
racy obtained during manned simulations required midcourse corrections of 100 to 
300 ft/sec, well within the propellant budget for nominal missions. 


Rendezvous 

In the Apollo Program, the CSM was the rendezvous target for the ascending LM. 
Rendezvous procedures using a concentric flight plan proved to be safe, flexible, and 
economical. The concentric flight plan was developed as a series of maneuvers to 
maintain a planned flight trajectory. The flight crew operated the onboard guidance 
and navigation system during rendezvous and monitored its performance. The opera- 
tion of the guidance and navigation system was governed by nominal system procedures, 
and performance monitoring was accomplished by backup charts. The rendezvous 
procedures were developed and verified by analyzing trajectories and errors by means 
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of digital programs. Simple procedures using a minimum of sensor information and 
onboard data were developed for backup and for monitoring the onboard guidance and 
navigation system. 

Concentric flight plan . - The role of the flight crew in space rendezvous opera- 
tions consisted of controlling the vehicle attitude, evaluating the progress of the tra- 
jectory, and, when necessary, computing backup solutions for the rendezvous 
maneuvers. The concentric flight plan was a rendezvous procedure developed specif- 
ically to provide the flight crew with simplicity of operation, high reliability of achieve- 
ment, and economy of propellant usage. 

The concentric flight plan was initiated by a spacecraft maneuver called concen- 
tric sequence initiation. This maneuver was made to establish a desired ratio of 
relative height to phase angle between the active and passive vehicles at the second 
maneuver. This second maneuver, designated as constant delta height, resulted in a 
constant differential altitude. Concentric sequence initiation was performed one-half 
revolution before the constant delta height maneuver. A third maneuver, terminal 
phase initiation, was executed to establish an active-vehicle trajectory that would 
intercept the trajectory of the target vehicle. The sequence of maneuvers and the 
critical parameters of the concentric flight plan are shown in figure 8. 

Two parameters, transfer elevation 
angle and transfer interval (fig. 8), com- 
pletely characterized the shape of the 
intercept trajectories of the concentric 
flight plan. These parameters were se- 
lected to reconcile conflicting requirements 
for optimum propellant economy, minimum 
error propagation, and maximum ease of 
operation. Because the time of arrival at 
a given elevation angle could be varied by 
changing differential altitude in the coel- 
liptical phase, the transfer time for a 
given transfer elevation angle could be 
controlled, and the requirements for light- 
ing, navigation, and ground tracking could 
be satisfied. By fixing the transfer eleva- 
tion angle and the transfer interval and by 
selecting a coelliptical pretransfer condi- 
tion, the shape of the rendezvous trajectory 
Thus, the flight crew could be trained to 
monitor rendezvous progress, to detect off-nominal conditions, and to develop a high 
degree of operational efficiency. 

During the terminal phase, the transfer interval and elevation angle were chosen 
to reconcile fuel economy and ease of control. A transfer interval of 130° was chosen 
as a result of simulation and flight experience. Shorter transfer intervals were costly 
in terms of transfer and braking velocity, and longer intervals propagated initial ve- 
locity errors in the transfer maneuver to large misses at intercept. The transfer 
elevation angle was also selected to ensure that the apparent inertial motion of the 
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CDH Constant differential height 
TPI Terminal phase initiation 
X Curvilinear downrange distance 

Z Differential altitude 

Figure 8. - Geometry for concentric 
flight plan. 


was held constant for various approaches. 
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target was near zero in the latter part of the intercept and to ensure that the transfer 
from a coelliptical trajectory was along the line of sight. For lunar orbit, a transfer 
elevation angle of approximately 26. 6° was used; for earth orbit, the angle was 27. 5°. 
The practical advantage of transfer- elevation- angle choice was a particularly simple, 
terminal-braking procedure. The CDR thrusted to null any apparent inertial motion 
of the target normal to the line of sight. 

During the coelliptical phase, the time of transfer to the terminal phase was 
selected to satisfy operational constraints such as lighting and tracking. Under stand- 
ard approach conditions, the coelliptical trajectory allowed the transfer time to be set 
by the appearance of a selected transfer elevation angle. 

For a given time of the constant delta height maneuver, it was necessary to 
achieve a correct value for the ratio of relative height and position. Because two de- 
grees of freedom existed and only one condition was to be satisfied, two procedures 
were possible. If a value of phase angle were given and the time of concentric sequence 
initiation were fixed, the height was constrained and could be obtained either by one 
two-axis maneuver at concentric sequence initiation or by two single-axis maneuvers 
at different times. Alternately, by letting the height be unconstrained, the correct 
ratio could be obtained by a single, horizontal, one-axis maneuver preceding the con- 
stant delta height maneuver. The horizontal maneuver was used to vary the value of 
differential height with the catchup rate to allow for dispersions in the orbit of the 
spacecraft. 

The out-of-plane problem was found to be uncoupled from the in-plane rendez- 
vous problem, and the computation and application of the solutions were handled sep- 
arately. In practice, when the out-of-plane motion was established, a corrective 
maneuver was performed in conjunction with a scheduled in-plane maneuver (such as 
concentric sequence initiation). The corrective maneuver nulled the existing out-of- 
plane rate and forced a node to occur one-quarter of a revolution later. When the node 
was reached, the velocity was nulled again; and the active vehicle was placed in an 
in-plane trajectory. The corrective maneuver was repeated where necessary. Small 
residual errors in the out-of-plane direction were corrected easily during the terminal 
braking maneuvers. 

Normal rendezvous procedures . - During rendezvous, crew attention was divided 
between operation of the primary guidance and navigation system (PGNS) and monitor- 
ing the progress of the rendezvous. One problem in developing rendezvous procedures 
was to devise a technique that would not overmonitor the PGNS when operations were 
normal but that would detect degrading system operations before maneuvers based on 
the degraded system were initiated. 

Rendezvous monitoring procedures: Several approaches to the problem of ren- 
dezvous monitoring, differing somewhat in philosophy, were used on Apollo missions. 

In the yardstick method, a moderately accurate but highly reliable source of maneuver 
information (such as the CMC or the Mission Control Center) was selected as the yard- 
stick. Based on the expected performance of the maneuver computing sources, accept- 
able tolerances were established; and each source was compared with the yardstick in 
a preestablished order. The first maneuver solution found to be within the specified 
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tolerance of the yardstick was executed. If no solutions were within the tolerance of 
the yardstick, the yardstick information itself was used for the maneuver. The obvi- 
ous shortcoming of the yardstick approach was that several valid solutions might be 
discarded, and the yardstick might be used when it was operating outside of expected 
accuracy limits. 

A second technique was a comparison of the available maneuver solutions fol- 
lowed by a selection based on the agreement of a majority of the solutions. Acceptable 
tolerances for all types of solutions were established. When three solutions were 
available and any two solutions were within the specified tolerances, the acceptable 
solution with the highest priority was executed. The use of four solutions was con- 
sidered the practical upper limit in rendezvous monitoring. 

Another technique to obtain maneuver values was the calculation of a weighted 
average of all available solutions. The averaging technique had two major disadvan- 
tages: the solution of the PGNS was not used to execute the maneuver (although it was 
usually the most accurate solution), and obvious difficulties were encountered in select- 
ing the weighting factor for each solution used in the averaging process. 

The procedure that was finally established for monitoring rendezvous used the 
comparison technique. The priority for acceptable solutions was, first, the PGNS; 
second, the CMC; and, third, the abort guidance system (AGS). If no agreement oc- 
curred among the solutions that were within specified limits, then the CMC solution 
was used. If either guidance system failed, values from manual rendezvous charts 
were substituted in the logic for the failed system. 

Crew task distribution: The procedures for operating spacecraft rendezvous sys- 
tems were distributed as follows. 

1 . Tasks of the CDR 

a. Execution of all automatic and manual attitude and translating maneuvers 

b. Operation of the PGNS during thrusting maneuvers 

c. Operation of the rendezvous radar 

d. Operation of systems accessible only from the CDR crew station 

2. Tasks of the LMP 

a. Operation of the AGS 

b. Operation of the PGNS in all cases not involving attitude maneuvers or 
translation 

c. Calculations and logging of data 

d. Operation of systems accessible only from the LMP crew station 
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The rendezvous data on board the spacecraft were in three books. The time line 
book contained the step-by-step operating procedures for both the nominal and the 
aborted mission from powered descent. The data card book contained the monitoring 
procedures and the provisions for all navigation data logging. The rendezvous chart 
book contained the manual backup charts for computing solutions to rendezvous maneu- 
vers by using basic sensor data available to the flight crew. 

Backup charts . - The backup solution for terminal phase initiation was computed 
by obtaining the differences between actual conditions observed just before terminal 
phase initiation and the conditions required at terminal phase initiation to achieve ren- 
dezvous. The observations needed for definition of the position of the two vehicles 
were range and range rate at a fixed time before terminal phase initiation and two 
measurements of the relative elevation angle at fixed times before terminal phase ini- 
tiation. The solution obtained was resolved into a velocity component along the line of 
sight and a velocity component normal to the line of sight at terminal phase initiation. 
The measurement geometry is diagramed in figure 9. 

The backup approach was feasible 
because the catchup rate of the active ve- 
hicle with respect to the passive vehicle 
was very nearly constant for coelliptical 
orbits, and range rate was a function of 
catchup rate and relative elevation angle. 
Thus, the values observed at a fixed time 
before terminal phase initiation could be 
used to infer the critical values (range 
rate and elevation angle rate) at terminal 
phase initiation. The differences between 
the estimated value and the values re- 
quired at terminal phase initiation could 
then be used to obtain a backup maneuver 
solution. 

The backup chart was graphical. 

The data used to plot the backup chart 
were computed by using a digital routine 
that generated the orbital parameters for 
a set of trajectories covering the region of 
expected dispersions about the nominal 
trajectory. The terminal-phase- initiation- 
backup chart carried on the Apollo 11 mis- 
sion is shown in figure 1 0. 



R Range 
R Range rate 

Figure 9. - Measurement geometry 
for terminal phase initiation 
backup . 
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The midcourse correction charts were similar to the terminal phase initiation 
backup charts with the following exceptions. 

1. The active vehicle was assumed to be on a collision course with the passive 
vehicle rather than in a coelliptical orbit. 

2. The midcourse correction maneuver was assumed to occur at the instant of 
the second measurement point rather than at a later fixed time. 

In all other respects, the midcourse correction charts were generated and used in the 
same manner as the terminal phase initiation chart. 

Concentric sequence initiation backup: Because the velocity change needed at 
concentric sequence initiation was not directly available as a function of observable 
parameters, an approach to a backup maneuver solution different from that used to 
solve the terminal phase initiation problem was necessary. Of the mathematical tech- 
niques for approximating an unknown function, the simplest was the Taylor series. 

For concentric sequence initiation, only the in-plane problem was to be solved. There- 
fore, four independent measurements served to constrain the problem. The simplest 
equation was an uncoupled power series of the observable parameters, range or range 
rate or both. For the situation in which concentric sequence initiation occurred as a 
result of a nominal ascent from the lunar surface and for similar trajectories, this 
approach worked well. The resulting tabular data are presented in figure 11. In this 
case, the measurements were of range rate at concentric sequence initiation minus 
30, 20, and 10 minutes; and of range at minus 10 minutes. As each measurement was 
obtained, the corresponding factor was determined from the table and logged in the 
space provided. At the last observation, the factors were summed to give the velocity 
change needed at concentric sequence initiation. 

Constant delta height backup: Range rate in a nearly coelliptical orbit could be 
closely represented by a sinusoidal curve. Moreover, relative velocity changes, both 
vertical and horizontal, were sinusoidal functions of range rate. Because the constant 
delta height maneuver depended only on the relative velocity and height differences be- 
tween the two spacecraft, three independent measurements were sufficient to define 
the sinusoidal curve. By using the sinusoidal functions of vertical and horizontal ve- 
locity changes, a nomographic solution of the constant delta height problem was con- 
structed and carried as onboard data. 

Performance analysis: After backup charts had been constructed, statistical 
analyses were made to determine how well the charts would perform. Data for the 
statistical analyses were generated by a computer routine that executed a large num- 
ber of simulated rendezvous and calculated statistical parameters of interest. 

One of the basic parameters examined in the analyses was the accuracy of the 
backup chart solutions. In addition, data were derived for miss distance at closest 
approach, for total fuel used in the rendezvous, and for arrival time at terminal phase 
initiation. The results of these analyses were used to establish source priority of 
maneuver solutions. 
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Figure 11.- Concentric sequence initiation backup table 













Onboard rendezvous evaluation: A primary crew function in manned space flight 
was the evaluation of the progress of rendezvous. Analyses of simulated rendezvous 
provided rule-of-thumb statements about the behavior of maneuver solutions after tra- 
jectory dispersions occurred. For example, the analyses indicated that an insertion 
dispersed behind the nominal phase angle (up- range distance) would propagate to simi- 
lar off-nominal positions at each point, particularly at the point of the constant delta 
height maneuver. If the phase angle were too large, the spacecraft was too far up 
range, and a larger differential height was necessary to arrive at the transfer eleva- 
tion angle at the correct time. Because orbital period was a function of energy, a 
shorter period (corresponding to a larger differential height) was required, implying 
a smaller change in velocity at concentric sequence initiation. 

Similar statements apply to horizontal overspeed at insertion. Analysis indicated 
that after nearly one revolution (for example, at constant delta height) an overspeed 
placed the spacecraft up range from the nominal position. Converse statements apply 
to an insertion phase angle that is too small or to an insertion underspeed. If the in- 
sertion error was in altitude rate, the position of the spacecraft after one revolution 
was nearly coincident with the nominal position; but the spacecraft altitude- rate error 
was nearly equal to that at insertion. Thus, the vertical component of the constant 
delta height maneuver needed change to remove the error, although the resulting dif- 
ferential height was little affected. When the pilot had information on the dispersions 
resulting from a particular case, he inferred the trend of his maneuver solutions from 
comparison to nominal. 


Lunar Descent and Ascent 

Background . - Approximately 1 year before the Apollo 11 mission, work was be- 
gun on the developing of detailed flight procedures for the descent and ascent phases 
of a lunar landing. Onboard computer programs, spacecraft configuration, and pre- 
liminary mission planning were partially defined, and some work was completed on 
the capability of the crew to detect off-nominal guidance performance. The current 
mission planning was integrated with onboard computer requirements, with systems 
requirements and constraints, and with crew and ground capabilities. A detailed flight 
procedure was developed that would allow the crew to function without ground assist- 
ance except for maneuver and computer updates. Independence from ground support 
was desirable for the following reasons: effective communications at lunar distance 
were unproven; crew operations would be more efficient if coordination with the ground 
were not critical; and communication contacts from lunar orbit would be impossible 
when the spacecraft was behind the moon. 

Development . - Initially, flight procedures were to be concerned only with the 
powered phases of lunar descent and ascent; however, the importance of certain pre- 
ceding events soon became evident. The decision was made to include in the descent 
procedures all events in the 2. 5- hour period from the time of undocking to lunar touch- 
down. The detail included in the first drafts of the flight procedures was sufficient 
for use on a simulator and for review and criticism. The onboard data were then con- 
densed from the final flight procedures documents. 
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The initial development of the flight procedures involved determination of the 
sequence of mission events, attaching time tags to known mandatory events, and sched- 
uling the support and highly desirable events in the best places possible. The manda- 
tory events for the descent were undocking, descent orbit insertion, and powered 
descent initiation. Procedures that constrained the descent phase of the mission were 
an inertial measurement unit alinement within 2 hours of initiation of powered descent, 
AGS alinement to the PGNS within 5 minutes of the descent burn, and AGS state-vector 
update from the PGNS within 10 minutes of the descent burn. These constraints had 
been identified by the hardware manufacturers or from guidance performance studies. 

Some proposed constraints could not be met realistically. For example, an 
early requirement was to aline the inertial measurement unit within 30 minutes (rather 
than 2 hours) of the descent burn. When it was determined that the alinement probably 
could not be conducted during lunar daylight, the constraint was dropped. 

Some items that were not mandatory but served to increase crew confidence in 
vehicle performance were added to the flight procedures. For example, the AGS was 
configured to monitor the descent orbit insertion burn and to check performance of the 
PGNS. For resolving differences between observed guidance values, a technique was 
added to the flight procedure to verify the correct value by using the rendezvous radar. 
The technique involved measurement of the resultant trajectory relative to the CSM. 

Other tasks were added to the descent procedures because they could not be per- 
formed before the vehicles undocked. For example, the rendezvous radar/transponder 
operation could not be verified in the docked configuration because of physical limita- 
tions of the spacecraft hardware. 

Visual inspections, which were added to the flight procedures, included an inspec- 
tion of the LM by the CMP immediately after undocking and a check of timed lunar 
landmark passage before powered descent initiation. The procedures for landing radar 
activation and self- test were added to the descent procedures because of time limita- 
tions in the LM- activation period. 

Verification . - When the logical and complete sequence of mission events was 
established, the detailed descent procedure was written. The procedure was used to 
verify that all the events could be accomplished in the allotted time. A cockpit mockup 
was first used for time and motion studies; later, more realistic computer time re- 
quirements were simulated. No problems were encountered during these studies, 
although the schedule during descent was found to be very tight. 

The Apollo 10 mission was planned to be flown exactly the same as the lunar 
landing mission, except for the final powered descent. The Apollo 10 mission verified 
that the general procedure was acceptable. 
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Changes for the Apollo 11 mission . - Some changes were made in the Apollo 11 
flight plan, such as rescheduling the landing radar test to a more convenient time. 

Other technical changes in the computer programs and flight procedures included the 
following items. 

1 . Measuring the undocking maneuver on board to facilitate ground-based pre- 
dictions of the LM orbit 

2. Loading an abort maneuver program to be effective 12 minutes after a failure 
to initiate powered descent, should the maneuver be required 

3. Verifying PGNS pitch alinement before powered descent initiation by computer- 
pointing the optics at the sun 

4. Preloading a landing- site state vector into the AGS to ensure availability of a 
good state vector upon touchdown 

5. Including a procedure by which the crew could time landmark passage and 
thus determine altitude on the basis of known velocity 

These changes were made to prepare for contingencies that might arise and to 
obviate possible deficiencies in Manned Space Flight Network orbit determination. 

During most of the descent, the LM was under automatic control; the crew was in- 
volved only with monitoring and decisionmaking until shortly before touchdown. The 
powered descent trajectory (table VII) was designed to reduce the velocity of the LM 
from approximately 5500 ft/sec at an altitude of 50 000 feet to 0 ft/sec at touchdown. 
Constraints were designed to provide the crew with continuous visibility of the landing 
site from high gate (approximately 7000 feet altitude) to low gate (approximately 
100 feet altitude). The range of velocities and attitudes below 500 feet facilitated crew 
takeover for a manually controlled landing. The LM was to be in a face-down attitude 
before powered descent initiation so that the crew could verify visually their position 
by sighting at preselected landmarks through marks on the LM left-forward window 
and their pitch attitude by sighting at the lunar horizon through marks on the overhead 
window. The inertial velocity, altitude rate of change, and total attitude could be com- 
pared between the displays of the two guidance systems and with predicted nominal 
values. Discrepancies could be identified by out-the-window checks and, when avail- 
able, by landing radar information. 

Because of the orientation of the radar antenna, the LM landing radar was not 
functional above 30 000 feet during descent. The crew had to maneuver the LM to a 
face-up position (Z axis radially up) to obtain radar data. When the radar data became 
available, the crew decided whether the data should be incorporated into the guidance 
system. This decision was based on reasonability and on precalculated limits. After 
the data were incorporated and convergence was verified, data from the AGS, not up- 
dated by the landing radar, would be in error, and thus would not be monitored closely. 
In addition to the trajectory parameters, the crew monitored vital spacecraft systems 
parameters (such as use of descent propulsion system propellant) but relied primarily 
on the absence of caution and warning lights and alarms to indicate safe performance. 
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TABLE VH. - GENERAL PROCEDURES DURING LUNAR POWERED DESCENT 



Time relative 


Spacecraft position 

to PDI a , 

Flight procedures 


min: sec 


Approaching powered 

-25:00 

Call for automatic braking 

descent initiation 
at 50 000 ft and 

-20:00 

Acquire Manned Space Flight Network 

270 n. mi. from 

-15:00 

Manual control to attitude of PDI 

landing site 

-10:00 

Update AGS and load state vector 


-5:00 

Check switches, go/no-go for descent, 



altitude, attitude, and position 

Approaching high gate 

+2:00 

Check altitude 

at 7000 ft and 
4 n. mi. from land- 

+3:30 

Check position 

ing site 

+4:00 

Yaw face up 


+5:00 

Enable landing- radar updating 


+7:00 

Evaluate manual control 


b +7:00 

Monitor trajectory and systems 

Between high gate and 

+8:30 

Monitor powered descent angles 

500-ft altitude 

to 

+10:00 

Evaluate landing site 

Redesignate landing site if necessary 

Update AGS altitude 

Between 500-ft alti- 

+10:00 

Manual control rate of descent 

tude and touchdown 

. to 
+11:30 

Select landing site 
Null horizontal velocity 
Monitor fuel 


^Powered descent initiation. 
Approximate time . 


At high gate, the LM pitched down so that the landing site was visible in the for- 
ward windows. The LM guidance computer calculated the angle between the plus 
Z axis of the vehicle (straight ahead) and the line of sight to the landing site. The angle 
was displayed on the display and keyboard and was called out by the LMP while the CDR 
sighted through the landing-point-designator markings on the window (fig. 12) to de- 
termine where the vehicle would land under full automatic guidance. If the landing site 
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were unacceptable, the CDR would select 
a suitable site and redesignate the landing 
by using the attitude controller assembly. 

A forward or backward motion of the as- 
sembly shifted the approach to the landing 
site down range or up range by 0. 5 , and 
a right or left motion shifted the site lat- 
erally by 2. 0°. In addition to calling out 
the landing-point- designator angle, the 
LMP continued to monitor and report alti- 
tude, altitude rate, and propellant quantity . 

Procedures for three types of land- 
ing modes were as follows: first, an 
automatic mode that required no crew ac- 
tion (with this mode, the vehicle might 
land on an uneven surface or in a crater); 
second, a semimanual mode, in which the 
CDR used the attitude controller assembly 
to fly to a suitable landing site, null the 
horizontal velocity, and control the rate of descent (activation of the rate-of- descent 
switch increased or decreased the rate of descent by intervals of 1 ft/sec); and, third, 
a completely manual mode, using the attitude controller assembly and the manual 
throttle. The manual mode was least desirable because of the possibility of propellant 
depletion before landing. Thus, the semimanual mode was selected as the prime mode 
for the Apollo 11 flight plan. 

In summary, the division of crew tasks in the descent procedures was as follows. 
The CDR monitored and controlled the altitude and attitude of the spacecraft, using 
external visual sightings to verify a proper trajectory, and completed the landing. The 
LMP monitored LM displays and advised the CDR of vehicle and trajectory status. 

Ascent procedures . - The procedures for powered ascent were similar to those 
for powered descent except that the landing radar was not available as a third source 
for altitude and altitude- rate data. However, these values were not as critical for as- 
cent as for descent. If the nominal attitude profile was maintained and an established 
minimum velocity was attained, a safe orbit insertion was assured. The AGS was 
monitored only to verify that the system was functional. 

For a condition in which neither guidance system was available for ascent, pro- 
cedures were developed to fly manually to a safe orbit by using the attitude controller 
assembly. On the basis of simulations in the LM procedures simulator, a safe orbit 
would always be achieved by allowing the ascent engine to burn to propellant depletion. 
However, an orbit with an excessive apogee could be obtained. The CDR could maneu- 
ver by using the attitude ball for reference or by using a sighting on the horizon through 
the angle marks on the overhead windows. The parameters for both modes were con- 
tained on the ascent monitoring card (fig. 13). If neither an attitude-hold nor a rate- 
damped control mode was available, a direct control mode that included two four- step 
profiles (one for attitude-ball reference and one for overhead window- horizon refer- 
ence) could be used. The two four- step profiles were added to the ascent monitoring 
card for the Apollo 11 mission (fig. 13). 
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Figure 13. - Ascent monitoring card. 



Entry 

Background . - The Apollo primary guidance and control system provided all the 
functions for determining and performing the proper maneuvers to return to earth with 
a safe entry. However, Mission Control Center personnel normally dictated the actual 
transearth corrections because the ground- tracking facilities provided better accuracy. 
If data were unavailable from either source because of equipment malfunctions, the 
onboard backup systems and charts could provide adequate displays for the flight crew 
to maintain the trajectory within the entry corridor and to guide the vehicle to a pre- 
selected target area. The checkout, monitor, and takeover criteria for spacecraft 
systems were incorporated into a single checklist together with the spacecraft attitudes 
and the flight techniques used during entry. 

Entry procedures for Apollo missions were divided into entries from lunar re- 
turn and entries from earth orbit. The monitoring checks are summarized in ta- 
bles VHI and EX. In the event of a malfunction, take-over criteria were established so 
that the crew could use the remaining equipment to ensure a safe landing at a prede- 
termined target. The monitoring points and limits and the alternate guidance and con- 
trol techniques were incorporated into each procedure to provide a concise and 
convenient entry checklist. 


TABLE Vm. - SUMMARY OF MONITORING CHECKS FOR LUNAR-RETURN ENTRIES 


Time relative to 
entry Interface, 
hr: min: sec, 
or event 

Check 

Effect of failure 

-30:00:00 

Verify entry monitor system (EMS) 
self-test. 

If the EMS has failed, no range beyond 1800 n. mi. 
can be targeted. If all accessible targets have 
bad weather, a midcourse correction is indicated. 

-01:00:00 

Verify EMS self-test, 

If the EMS has failed, the constant-g mode becomes 
the prime backup mode. 

-00:30:00 

Check horizon to test inertial meas- 
urement unit (IMU) alinement 
and displays. 

If the IMU has failed, the guidance, navigation, and 
control system (GNCS) is no-go. Isolate the error 
source. 

Entry initializa- 
tion program 

Monitor display of range to target. 

If an improper target is loaded, the GNCS is no-go. 
Complete the entry using EMS mode. 

At 0. 05g 

Verify automatic computer program 
sequence and automatic EMS 
initialization. 

If the GNCS is no-go, complete the entry by using 
the EMS mode. Manually initiate the EMS at 
predicted time plus 3 sec. If manual initializa- 
tion is unsuccessful, use the constant-g backup 
mode. 

+00:01:00 

Check corridor and initial lift- 
vector orientation. 

1 

If the EMS is commanding proper attitude, reverse 
Initial attitude and return to automatic control at 
1.5g. 

Continuous EMS 
check 

Verify that EMS g-level is within 
+ lg of g-meter value. 

Check the g-level with the computer callup and fail 
the system in disagreement with the other two 
sources. 

Continuous GNCS 
checks 

Verify that vehicle attitude is re- 
sponding to displayed roll 
commands. 

Switch to backup roll thrusters to isolate failure. 

If no effect and the GNCS is go, manually fly roll 
commands. If the GNCS is no-go, complete the 
entry with manual control and the EMS. 


Verify that roll commands avoid 
violation of onset and offset lines 
with g-V trace on EMS scroll. 

If the GNCS is no-go, complete the entry with the 
EMS and manual ranging. 


Verify automatic program 
sequencing 

If the GNCS is no-go, complete the entry with the 
EMS and manual ranging. 


For long-range targets, verify 
specified control constants dis- 
played to ensure a safe ballistic 
trajectory. 

If the GNCS is no-go, complete the entry with the 
EMS and manual ranging. 
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TABLE IX.- TYPICAL MISSION TIME LINE FOR A NOMINAL RANGE TARGET 


Time relative to 
entry interface, 
hr: min: sec 

Event 

-- 

Initial stowage 

-- 

System checks 

-06:00:00 

Last midcourse correction decision 

-03:00:00 

Last midcourse correction 

-01:15:00 

Maneuver to entry attitude 

-01:00:00 

EMS go/no-go tests 

-00:55:00 

Gyro display coupler drift check 

-00:45:00 

Navigation update and entry-pad data 

-00:35:00 

Roll indicator set for EMS initialization 

-00:25:00 

Separation checklist 

-00:19:00 

Entry preparation program inception 

-00:18:00 

CM/SM separation and preentry maneuver program 
inception 

-00:17:00 

Horizon attitude check 

-00:15:00 

CM/SM separation 

-00:12:00 

Entry initialization program with sequences for lift-up 
entry (horizon tracking) inception 

-00:05:00 

Pitch-error needle converging to zero (0.05g attitude 
hold) notation 

-00:01:30 

Pitch-error needle converging to zero (horizon tracking) 
notation 

00:00:00 

Entry interface at 400 000 ft 

+00:00:28 

Post-0. 05g program inception 

+00:00:31 

Manual EMS initialization (if required) 

+00:02:08 

Velocity equal to satellite velocity 

+00:02:08 

Final phase program automatically sequenced 

+00:08:16 

Drogue parachutes deployment 

+00:09:04 

Main parachutes deployment 

+00:13:59 

Splashdown 
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Lunar- return entries . - Lunar- return entry procedures for Apollo missions 
were based on the following criteria. 

1 . The timespan between the maneuver establishing entry conditions and the 
actual entry into the earth atmosphere 

2. The level of crew activities 

3. The routine tasks requiring procedures executed earlier in the mission 

4. The monitoring capabilities of the hardware and crew 

5. The identification of malfunctions and contingencies 

6. The operational alternatives available to the crew 

The procedures in the entry checklist included only the general category of ac- 
tivity until several hours before entry because detailed procedures were available in 
the general onboard checklist data. As crew workload increased while approaching 
entry, use of a detailed checklist became necessary to monitor specific checkpoints 
and to determine associated alternatives in case of a contingency. The use of simula- 
tions for entry training covering this critical period of heavy activity verified the orga- 
nization and detail in the flight procedures. 

Crew tasks and takeover criteria: Preparation for lunar- return entry began with 
the transearth injection (TEI) maneuver performed using the SPS. After the TEI ma- 
neuver was completed, the crew prepared for entry by performing alinement checks, 
trajectory corrections, and system management duties similar to those performed 
throughout the mission. Duties unique to the entry task began after the time designated 
for the final midcourse correction (approximately 3 hours before entry). The events 
for the nominal lunar- return entry are shown in table IX. Crew tasks during this 
period were as follows. 

1 . General system management and entry preparation 

2. Entry-pad and computer-data up links from the Mission Control Center 

3. Entry monitor system (EMS) self- checks 

4. Entry- attitude alinement and horizon checks 

5. Entry program preparation and checks 

Guidance checks associated with entries initially consisted of star-tracking tech- 
niques performed throughout the flight. For guidance checks as the spacecraft ap- 
proached entry, a second method was recommended that involved measuring the 
earth-horizon alinement with a designated window mark to provide a reliable fix on the 
entry attitude and a checkpoint on the guidance data. It was desirable to perform sev- 
eral of these checks, the last of which was a final check on the automatically com- 
manded attitude just before entry. If the final check were satisfactory, the spacecraft 
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control was placed on automatic steering. The horizon checks had an advantage over 
the star and sextant attitude checks because they could be performed while the 
crewmen were secured in their couches and while the spacecraft was in the entry 
configuration. 

The primary guidance accelerometers sensed the first indication that the entry 
phase had begun, and this information was displayed by an onboard computer read-out. 
As spacecraft acceleration reached 0. 05g, the initial entry-control program of the 
primary guidance system commenced automatically, an 0. 05g acceleration in the EMS 
was indicated by a display light, the display change was noted by the crew, and the in- 
tegration process for determining the decreases in range and velocity was activated. 

If the program change was not accomplished within a predicted time, the primary 
guidance was considered unusable. If the 0. 05g indication did not occur within several 
seconds of predicted time, the crew started the EMS manually to preserve monitoring 
capability. 

The EMS also provided an entry- corridor check by indicating whether a lift-up 
or a lift- down attitude should be flown. The corridor check was performed by sensing 
the g-level 1 0 seconds after 0. 05g initiation and comparing this g-level to a reference 
constant. This gross check did not allow for lift-to-drag and atmospheric variations 
but was available if loss of both communications and primary guidance eliminated a 
more accurate indication. A lift- down attitude on the initial entry was required only 
for extremely shallow entry angles in the corridor, but the safeguard of having the 
gross check available from an independent source was desirable to reduce further the 
chances of skipout. 

A real-time trace of the spacecraft load factors as a function of spacecraft ve- 
locity (g-V) was made by the EMS on a scroll that contained predetermined parameters 
for safe entry and for landing-point targeting (fig. 14). This display served as a check 
on the automatic guidance system and provided sufficient information for safe manual 
control to intermediately ranged targets. 



-3 

Velocity, fps x 10 


Q Onset guide line 
@ Offset guide line 
( 3 ) Satellite velocity indicator 
0 Range potential line 
0 Full lift profile 

Figure 14.- Entry monitor system g-V scroll. 
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The most critical phase of entry occurred from the time TEI began until the 
spacecraft velocity became subcircular. During this phase, the mandatory monitoring 
tasks (to ensure against skipout or excessive g-loads) were the initial- g onset control, 
the peak-g control, and the energy control. Normally, a lift-up vector was held from 
entry interface through the peak-g period for the majority of entry conditions. If shal- 
low entry conditions dictated a lift- down vector, the initial lift- down control was held 
only long enough to ensure atmospheric capture (too long a hold would cause excessive 
g- loading). 

Peak-g control monitoring ensured that guidance commands were not initiated to 
increase g-loading. A full lift-up attitude was maintained until the time for energy- 
control maneuvering. Any other command from automatic steering would necessitate* 
manual takeover. 

The energy-control maneuvering resulted in the safe expenditure of spacecraft 
energy until a subcircular velocity was reached. A constant-g level was maintained, 
and the crew monitored convergence to a g-value by observing g-level and roll com- 
mands. The required constant-g level was a function of initial entry velocity and was 
available to the crew from the data pad. If the value of the constant could not be ob- 
tained because of an equipment failure, the crew could fly manually at a predetermined 
g-level, which was nearly constant and which had been well established during training. 
Energy- control maneuvering also allowed retention of sufficient energy in reserve for 
target ranging. Targets ranging from approximately 1500 to 2500 nautical miles re- 
quired a proportional up- vector control phase that approached skipout conditions and, 
therefore, increased the monitoring tasks. The capability was retained because 
weather conditions could dictate changes in target area; however, the longer the range, 
the greater the monitoring task and the more difficult the task of flying manually to the 
target. Because a near- skipout condition had to be avoided, the reliability of targeting 
with manual control for points at distances over 1600 nautical miles decreased sub- 
stantially with increased range. 

Although the trajectory to the target was calculated during the early phases of 
the entry, ranging to a selected target usually began when the trajectory became sub- 
circular. The g-V trace indicated the range capability by intersection of the trace 
with the range-potential lines. The range-potential lines were generated for the scroll 
by plotting the distances that could be covered at various constant-g levels. By noting 
the current range potential and the remaining EMS range, the crew could determine if 
steering were adequate for proper targeting. 

Backup procedures: The nominal lunar- return entry checklist incorporated many 
checkpoints and criteria for switchover to manual control of the entry. Because the 
checklist was abbreviated, some detail in backup technique was omitted; but backup 
techniques were thoroughly covered in crew training. Malfunctions were covered by 
the following alternatives. 

1. Loss of communications: The onboard targeting program was available if 
entry parameters could not be relayed from the Mission Control Center. Other perti- 
nent information was available in the routine entry programs and could be used for 
EMS initialization and final targeting criteria. 
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2. Loss of primary guidance: The EMS not only served as an entry monitor 
display but also indicated sufficient information for a crew-controlled entry to a pre- 
determined target. If the primary guidance system failed, the spacecraft would ini- 
tially be manually controlled to nearly the same criteria and checkpoints that the 
automatic system would have provided. Once suborbital velocity was reached, the 
crew would use the ranging technique practiced in simulations (i. e. , matching range- 
to-go with range potential). This training was necessary because the crew had only 
the range-to-go integration and the range-potential traces as guidelines. The crewmen 
would attempt to match these values by rolling the spacecraft to control the lift vector. 

3. Loss of primary guidance and entry monitor system: Although the probability 
of loss of primary and backup systems was extremely remote, training established a 
safe procedure by using the onboard gravity meter. Although ranging capability would 
be lost, the technique of controlling the vehicle to a predetermined constant-g level 
allowed for a safe entry and a good splashdown-point prediction to the recovery forces. 


CONCLUDING REMARKS 


The complex nature of the Apollo spacecraft systems and missions required the 
participation of many engineering specialists to determine effective crew procedures. 
The development of procedures was required along two distinct lines: systems pro- 
cedures and flight procedures. Systems procedures, largely independent of the mis- 
sion plan, were developed with the assistance of the prime contractors and encompassed 
all the systems operating modes. Flight procedures produced an optimized crew time 
line for each mission phase by incorporating mission constraints and requirements 
with appropriate system operating modes. 

Procedures documentation, like procedures development, was accomplished in 
two categories. Systems procedures were recorded in the Apollo Operations Handbook, 
which became the source of approved operating modes and provided a vehicle for offi- 
cially distributing procedures changes resulting from hardware and software modifica- 
tion and testing. Flight procedures were recorded in flight procedures documents with 
one volume for each of several critical mission phases. Portions of the Apollo Opera- 
tions Handbook and flight procedures documents were included in the flight data file 
for use by the crew in flight. 

During the Apollo Program, it was found that a procedures control board was 
necessary to maintain correct crew procedures when various mission and systems 
changes were made. This board ensured that every organization concerned with mis- 
sion operations was provided with current and complete information on crew operation 
of the spacecraft, that all proposed procedural changes received a thorough review, 
and that management had sufficient information concerning the number and nature of 
procedural changes. 
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A significant fact learned during procedures development for the Apollo Program 
was that the crew, given certain basic flight displays, could perform the following 
functions: monitor and assess the performance of automated systems during normal 
operation; accomplish the primary mission objectives despite many kinds of subsystem 
failures or degraded situations; and make real-time decisions during emergencies to 
abort the primary mission and return safely to earth, to accomplish alternate mis- 
sions, or to continue the primary mission by using manual backup techniques, thereby 
enhancing both crew safety and mission success. 

Manual backup procedures were developed for the following critical mission 
phases. 


1. Launch into earth orbit: In the event of booster malfunction, the crew could 
terminate the ascent or take control of the booster attitude and manually guide to earth 
orbit. 


2. Translunar injection: If the booster guidance failed, the crew could take 
control and continue the translunar injection thrusting by guiding to the nominal attitude- 
angle profile. 

3. Rendezvous: The best procedure for rendezvous monitoring was to compare 
maneuver solutions from the lunar module and command and service module guidance 
systems with chart solutions obtained manually by using raw data from radar and angle 
sensors. A significant fact learned during the Apollo Program was that all rendezvous 
maneuvers could be calculated and performed with simple manual techniques by using 
basic sensor displays and onboard charts with an accuracy only slightly degraded from 
that of the primary guidance and navigation system. 

4. Lunar descent: The crew could successfully monitor the descent by observing 
the spacecraft attitude, altitude, and position relative to known landmarks through the 
spacecraft windows and by comparing these observations with computer displays. Dur- 
ing the final 10 000 feet of descent, the crew could adjust the flight- path angle for clear- 
ance of terrain obstacles and control touchdown velocities to within acceptable limits. 

5. Lunar ascent: Display monitoring and out- the -window monitoring were found 
adequate to detect and recover from most types of failures. However, lack of a third 
source of altitude information required participation by ground-based tracking to 
identify certain guidance system component failures. Successful procedures were de- 
veloped for achieving near-nominal lunar-orbit conditions for any single guidance and 
control failure except failure of the, ascent propulsion system. 

6. Entry: The automatically guided entry was monitored by use of the entry 
monitor system. It was found that the skipout margin could be continuously observed 
and, if necessary, the spacecraft attitude could be manually controlled to obtain a safe 
splashdown. A second backup procedure, using only an attitude indicator and a gravity 
meter, was also developed for use in case of failure of both the primary guidance sys- 
tem and the entry monitor system. 
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On the basis of experience gained through the time of the Apollo 11 mission, the 
following general conclusions relating to crew procedures can be made. 

1 . Automated modes designed into the Apollo systems proved successful in per- 
forming complicated mission plans using a minimum of propellant and in relieving the 
crew of many tedious tasks. 

2. Onboard monitoring of automatic functions was best accomplished by crew 
observation of basic flight data such as velocity, attitude, and range rate; or of over- 
all system outputs such as attitude errors and maneuver solutions; or of all these. 

3. Given accurate sensor display information, successful manual backup pro- 
cedures could be developed for completion of the primary mission or for an abort to 
an alternate mission for all mission phases. 
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